Docs / Obsidian Vault / Sharing
Families and teams
An organization shares items among a group of people: a family, a team or a whole company. Everyone keeps their own private vault as well; only what you put in the organization is shared.
Plans
| Plan | For | Includes |
|---|---|---|
| Family | Up to 6 people | Premium for every member, and shared collections |
| Team | Teams, billed per person | Premium for every member, collections and groups, policies, the event log and account recovery |
| Business | Companies, billed per person | Everything in Team; single sign-on, directory sync and custom roles come in a later version |
See Plans for what Premium includes.
Creating an organization
Open Organizations under Tools and choose Create an organization. Give it a name, choose the plan (and, for a team or business, how many people), and name the first collection. A new organization starts with a 30-day free trial, with no card needed. You are then taken to Stripe to set up billing, which keeps the trial days and asks for no card yet; add payment details on the Billing tab before the trial ends to keep the plan. Until online payment is set up on the service, we contact you about billing instead.
Inviting people
- On the organization's Members tab, choose Invite people.
- Enter up to 20 email addresses, choose their role and which collections (and groups) they can use.
- Each person gets an email with a link, valid for 5 days. They accept it, creating an account first if they need one.
- Back on the Members tab, Confirm each person who accepted. You are shown their fingerprint phrase: compare it with them, by phone or in person, before you confirm. Only confirmed members see the organization's items.
You can resend an invitation, change a member's role and access, or remove them at any time. A member can also leave on their own.
Collections
Collections hold the organization's items, like shared folders. Give each collection to the people (or groups) who need it, and choose for each whether they may only read, whether passwords are hidden from them, and whether they may manage the collection. Use a slash to nest collections, like "Marketing/Social".
To put an item in the organization, open it and choose Move to an organization from its menu, then pick the collections. Deleting a collection keeps its items; items in no collection are visible to owners and admins only.
Groups
On team and business plans, gather people into groups (such as "Accounts" or "Field staff") and give collections to the group instead of to each person.
Roles
| Role | May |
|---|---|
| Owner | Everything, including billing and deleting the organization. |
| Admin | Everything except billing, deleting the organization and changing owners. |
| Manager | Manage the collections they are assigned to. |
| User | Use the collections they are given. |
There is always at least one owner. A user can also be given manage on one collection.
Policies
On team and business plans, owners and admins can set rules for members (owners and admins themselves are exempt from most, so someone can always run the organization):
| Policy | What it does |
|---|---|
| Require two-step login | Members without two-step login can't be confirmed, and are removed when the policy is turned on. |
| Master password rules | A minimum length and strength for members' master passwords. |
| Password generator rules | Minimums for generated passwords and passphrases. |
| Single organization | Members may not belong to another organization. |
| No personal items | Members save new items in the organization only. |
| No one-to-one sharing | Members can't share items with people outside it. |
| Vault timeout | The longest time a vault may stay unlocked, and whether it then locks or signs out. |
| Account recovery | Lets admins reset members' forgotten master passwords (below). |
| No emergency access | Members can't name emergency contacts. |
| No export | Members can't export their vault. |
Event log
On team and business plans, the Event log tab lists what happened, newest first: items added, changed, moved, deleted, restored and imported, collections and groups changed, members invited, joined, confirmed, changed, removed and recovered, and policy changes, each with who did it, when, the kind of device and its network address. It never shows item contents.
Account recovery
On team and business plans, with the Account recovery policy on, members can enrol: a copy of their vault key is locked to the organization. If an enrolled member forgets their master password, an owner or admin can set a temporary one for them; the member must choose a new master password the next time they sign in, and all their devices are signed out. Admins can't recover owners; only another owner can.
You can enrol once an admin has confirmed you. The web vault and the Windows app then show the organization's fingerprint phrase: compare it with an owner or admin (owners and admins see it on the organization's settings page, or in Organizations in the Windows app) before you agree, and confirm with your master password.
With automatic enrolment on, enrolment is required: once a member is confirmed, the web vault and the Windows app ask them to check the phrase and enrol. Nobody is enrolled without that check.
Billing
Owners manage the plan and payment on the organization's Billing tab, which shows the trial's end date during the trial. Plans are billed yearly. Team and business plans count confirmed members. If the subscription ends, the organization becomes read-only; nothing is deleted. Deleting the organization ends its subscription straight away.